In line 3 of your form markup, you’re passing two arguments to wp_create_nonce when it only accepts one. It’s a simple typo. You’ll want to concatenate the string like so:
wp_create_nonce( 'edit_post-'. $post->ID ) //dot instead of comma
EDIT: I’d suggest you give the nonce field a more specific name than _wpnonce, as this is the generic(default) WordPress name for nonce fields, which means you probably have a conflict with other core nonces or a plugin nonce. Maybe try something like this:
// change the NONCE name to something unique
$data .= '<input type="hidden" id="wpse263026_nonce" name="wpse263026_nonce" value="'. wp_create_nonce( 'edit_post-'. $post->ID ) .'" />';